Data Breaches Reported by Illinois Health Plan and New York Provider of Children and Family Services
Security incidents have resulted in the exposure of patient data at Meridian Health Plan of Illinois and Little Flower Children and Family Services.
Meridian Health Plan of Illinois
Meridian Health Plan of Illinois, a government-sponsored managed care service provider, has announced a data breach affecting 21,027 individuals. The incident was detected on April 28, 2026, when unauthorized access to the Meridian provider portal was identified. The provider portal is used by healthcare providers to manage patient information and process claims.
The unauthorized access was blocked, and an investigation was launched to determine the nature and scope of the breach. Meridian Health Plan has confirmed that personally identifiable information such as member names, contact information, and dates of birth had been exposed, along with protected health information such as Member ID numbers, health plan names, eligibility and claims information, and provider information. At the time of issuing notification letters, no misuse of the exposed information had been identified. Credit monitoring and identity theft protection services do not appear to have been made available.
Little Flower Children and Family Services
Little Flower Children and Family Services, a New York-based provider of support services to individuals with developmental disabilities and their families, has recently issued notification letters to individuals informing them that some of their information was exposed in a recent security incident.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Unusual network activity was identified on March 20, 2026, and the forensic investigation confirmed unauthorized access to its network between March 12, 2026, and March 20, 2026. While the review of the affected data is ongoing to determine the specific information exposed, Little Flower Children and Family Services said the types of data likely compromised in the incident include the following:
Name, address, phone number, email address, date of birth, Social Security number, driver’s license number, state ID number, taxpayer ID number, passport number, financial account information, payment card information, digital signature, biometric data, diagnosis and treatment information, prescription information, Medicare/Medicaid number, health insurance information, and treatment cost information. The affected individuals are being offered complementary credit monitoring and identity theft protection services, and steps have been taken to improve security to prevent similar incidents in the future.
